ISO 27400 Foundation cheat sheet

IoT system model per ISO/IEC 27400 comprises device, gateway/edge, network, cloud/service, and application/user layers; security and privacy controls are needed at every layer and at each interface between them.

Core security properties for IoT: confidentiality, integrity, availability, authenticity, accountability, and non-repudiation. Privacy adds purpose limitation, data minimisation, and transparency toward users and bystanders.

IoT devices are typically constrained in CPU, memory, energy, and bandwidth; controls must be proportionate, so lightweight cryptography, secure boot, and hardware root of trust are preferred over heavyweight mechanisms.

Privacy-by-design principles: proactive not reactive; privacy embedded into design; full functionality (positive-sum); end-to-end security; visibility and transparency; respect for user privacy; privacy as default.

Data protection principles relevant to IoT: lawfulness and fairness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability of the operator.

Security-by-design and defence-in-depth: assume compromise of any single layer; segmentation, least privilege, fail-safe defaults, and separation of duties limit blast radius from a compromised device.

Lifecycle view: concept, development, production, deployment, operation, maintenance (including patching), and decommissioning/disposal. Security obligations exist at every phase, including secure erasure of credentials at end of life.

Risk-based approach: controls are selected according to identified threats, vulnerabilities, likelihood, and impact, considering the device role, deployment environment, and data sensitivity rather than a fixed checklist.

Threat sources include accidental (misconfiguration, wear, environmental failure), malicious (hackers, insiders, organised crime, state actors), and environmental (power loss, physical damage, natural events).

Common device-level weaknesses: default or hard-coded credentials, unpatched firmware, unnecessary open ports and services, weak randomness, debug interfaces left enabled, and no secure boot or verified update path.

Network-level risks: eavesdropping, man-in-the-middle, replay, spoofing, denial of service, and insecure protocols; controls include TLS/DTLS, mutual authentication, network segmentation, and intrusion detection.

Privacy threats specific to IoT: over-collection by sensors, re-identification from metadata, inference of behaviour, unauthorised secondary use, and lack of user awareness of bystander data capture.

Access control controls: unique per-device identities, least-privilege role models, strong authentication (certificates or hardware-backed keys), and revocation mechanisms for lost or retired devices.

Secure update and lifecycle controls: signed firmware, secure boot chain, rollback protection, vulnerability monitoring, coordinated disclosure, and a defined support period communicated to customers.

Data protection controls: encryption at rest and in transit, pseudonymisation or anonymisation where feasible, local/edge processing to reduce data movement, retention limits, and audit logging of access.

Physical and supply-chain controls: tamper detection, secure provisioning, trusted component sourcing, and verification of third-party software components and their provenance.